We process emails looking for order numbers (ON). We need to be able to compare the order numbers we seen in the emails to our database. We're looking for matching and not matching order numbers.
How the data looks.
ONemail: 123, 234, 345, 456
ONdatabase: 123, 098, 456
Order numbers that match (seen in both database and emails): 123, 456
Order numbers only seen in database: 098
Order numbers only seen in emails: 234, 345
index = a OR index = b | table ON_email ON_database<< This works and shows all the data.
But when i try to compare i can't see any data.
index = a OR index = b | eval ON=coalesce(ON_email, ON_database) | stats dc(index) values(index) BY ON
Or maybe this:
index = a OR index = b | eval ON=coalesce(ON_email, ON_database) | stats values(ON) BY index
index = a OR index = b | makemv ON_email delim="," | makemv delim="," ON_database | eval ON=coalesce(ON_email, ON_database) | mvexpand ON | stats values(ON) by index
| eval count=0 | append [ search | stats count by order_number ] | stats sum(count) AS Total | where Total>0
in this way you can find the result of the first search that are also in the second one.
Be careful: the field name must be the same in both the searches, id they aren't, rename one of them.